THE HUYGENS PROBE SYSTEM DESIGN
K. C. CLAUSEN1 , H. HASSAN1 , M. VERDANT1 , P. COUZIN2 , G. HUTTIN2 , M.
BRISSON2 , C. SOLLAZZO3 and J.-P. LEBRETON4
1 ESA Science Directorate, Scientific Project Department, ESTEC, Postbus 299, NL-2200 AG
Noordwijk ZH, The Netherlands
2 Aerospatiale2 B.P. 99, F-06322 Cannes-La Bocca, France
3 ESA Technical and Operations Support Directorate, Huygens Probe Operations Centre, ESOC,
Robert-Bosch Straße, Darmstadt, Germany
4 Research and Scientific Support Department of ESA/ESTEC, P.O. Box 299, 2200 AG Noordwijk,
The Netherlands ∗ (Jean-Pierre.Lebreton@rssd.esa.int)
Received 11 February 1999; Accepted in final form 25 June 2002
Abstract.
The Huygens Probe is the ESA-provided element of the joint NASA/ESA Cassini/Huygens
mission to Saturn and its largest moon Titan. Huygens is an entry probe designed to enter Titan’s
atmosphere and descend under parachute down to the surface. The Probe is carried to Titan on board
the Cassini Saturn Orbiter. Huygens is dormant for 7.2 years, during the interplanetary journey and
during the first 6 months around Saturn. It is activated about every 6 months for an in-flight checkout
to verify and monitor its health and to perform a periodic maintenance and calibration of the payload
instruments. The Probe will be targeted to Titan and released from the Orbiter about 3 weeks before
the Titan encounter on the third Orbit around Saturn. During the 3-week coast phase the Probe is
‘OFF’, except a timer unit that has the task to awaken Huygens before it enters Titan’s atmosphere.
The Probe’s aeroshell will decelerate it in less than 2 minutes from the entry speed of about 6 km s−1
to 400 m s−1 (Mach 1.5) at an altitude of 150–180 km. From that point onwards, a pre-programmed
sequence will trigger the parachute deployment and the heat-shield ejection. The main part of the
scientific mission will then start, lasting for a descent of 2–21/2 hours. The Orbiter will listen to the
Probe for a total duration of at least 3 hours, which includes time to receive data from the surface,
should the Probe continue to transmit data after touchdown. Huygens’ transmissions are received and
stored aboard the Orbiter for later retransmission to the Earth.
This paper presents a technical description of the elements of the Huygens Probe System. The
reader is invited to refer to the companion paper (Lebreton and Matson, 2002) for further background
information about the Huygens mission, and the payload. The early in-flight performance of the
Probe is briefly discussed. During in-flight testing in 2000, a technical anomaly was found with the
Probe-to-Orbiter telecommunication system that required a change in the Huygens mission scenario
designed before launch. It required also a change in the Orbiter trajectory during the Probe mission.
This change was achieved by modifying the initial Cassini/Huygens orbits around Saturn. At the
time of writing, details of the implementation of the revised Huygens mission scenario are still being
worked.
∗ Address to which correspondence should be sent.
Space Science Reviews 104: 155–189, 2002.
© 2003 Kluwer Academic Publishers. Printed in the Netherlands.
156
K. C. CLAUSEN ET. AL
Figure 1. The Huygens overall development schedule: SRR: System Requirement Review; PDR: Preliminary Design Review; SDR: System Design Review; MHDR: Mechanical Design Review; EHDR:
Electrical Design Review; CDR: Critical Design Review; FAR: Flight Acceptance Review; LRR:
Launch Readiness Review. The Huygens Probe was also submitted to NASA’s External Independent
Review Process.
1. The Huygens Technical and Programmatic challenges
The Huygens Probe is the European Space Agency (ESA) first planetary atmospheric entry mission. It is part of the joint NASA/ESA Cassini Huygens mission
to Saturn and Titan. Several of the technologies required for Huygens were very
different from those needed for more traditional satellite missions (Hassan et al.,
1994, Hassan et al., 1997). The development of Huygens presented a considerable
challenge both to ESA and to European Industry. Special systems such as the
Thermal Protection System and parachutes had to be developed specifically for
the entry into Titan’s atmosphere. These factors and ESA’s geographical-return
requirements presented special management challenges, which had to be solved
in order to achieve the prescribed objectives. Following several years of studies
(Lebreton and Matson, 2002), the industrial development activities of the Huygens
Probe started in early 1990, and followed the schedule illustrated in Figure 1. The
main industrial contractor, Aerospatiale (now Alcatel Space), Cannes, France, was
selected at the end of 1990 and the detailed definition phase (phase B) started in
mid-January 1991. The composition of the industrial Team was finalised at the end
of Phase-B. As Figure 2 shows, it represents a very broad spectrum of European
space industries with some involvement of US industry in very specific areas.
The overall Cassini/Huygens mission is managed by the Jet Propulsion Laboratory (JPL) for NASA. Early during phase B, clear programmatic and technical
interfaces were established between ESA and JPL which allowed both ESA’s Huygens Probe and NASA/JPL’s Cassini Saturn Orbiter to proceed on parallel tracks
with well identified interface definition and validation milestones.
THE HUYGENS PROBE SYSTEM DESIGN
157
Figure 2. The Huygens industrial consortium is spread all over Europe and includes firms in the US.
2. The Huygens Probe System and its mission
The Huygens Probe has been designed to be carried to Titan by the Cassini Saturn
Orbiter with all its equipment in the OFF state. The Huygens Probe System consists
of the Probe itself and the Probe Support Equipment (PSE). The Probe will detach
from the Orbiter and enter into Titan’s atmosphere three weeks later, whereas the
PSE will remain attached to the Orbiter. The PSE consists of the electronics necessary to track and recover data from the Probe during its descent and to process
this data for recording on the Orbiter solid-state recorders, for later transmission to
Earth when the Cassini-Earth link will be re-established after the Probe mission is
over. The PSE also provides a command and data link to the Probe whilst the latter
is attached to the Orbiter.
Following its launch in October 1997, the Probe System remains in a dormant
state for seven years as the Cassini/Huygens spacecraft follows its cruise trajectory
via Venus (twice), Earth and Jupiter, before finally entering the Saturnian system in late June 2004 (Figure 3). During the cruise phase, Huygens is activated
for its scheduled bi-annual health checks. These in-flight checkouts, which last
between 3 and 4 hours, have been designed to follow as closely as possible the
pre-programmed descent scenario. The purpose of those bi-annual health checks
(called Probe checkouts) is to perform periodic instrument maintenance and regular
payload sensor calibration. Additionally, the PSE alone can be activated to support
in-flight end-to-end testing of the receiving elements of the Huygens telecommu-
158
K. C. CLAUSEN ET. AL
Figure 3. The Cassini/Huygens Interplanetary trajectory.
nication system. Such end-to-end tests are carried out by using a NASA Deep
Space Network Antenna to mimic the Probe radio transmissions. The Huygens
receiver anomaly was discovered as a result of the first end-to-end relay test carried
out in February 2000 (see section 8.3).
On reaching Saturn, the composite Cassini/Huygens spacecraft will enter a
highly eccentric capture orbit around the planet. The first two orbits around Saturn are used to prepare for the required geometry that needs to be achieved to
conduct the Huygens mission on the third orbit (Figure 4). Prior to Probe release,
the composite Orbiter/Probe will be targeted on to a collision path to Titan. About
22 days before Titan encounter, the Probe will be released from the Orbiter. It
will then enter into coast phase. Five days after Probe separation, the Orbiter will
initiate a deflection manoeuvre to avoid Titan itself and to be placed on a trajectory
optimised for the acquisition of Probe data during descent and while on the surface.
The communication window with the Probe is designed to last at least 3 hours for
a maximum descent time of 21/2 hours.
Prior to the Probe separation from the Orbiter, a final health-check will be
performed and the coast timer will be loaded with the precise time necessary to
‘wake-up’ the Probe systems prior to encountering Titan’s atmosphere. For 22
days, the Probe will coast to Titan with no possibility of changing the attitude
parameters acquired at separation. The only unit electrically active during the coast
is the triple redundant wake-up timer.
At the end of the 22-days coast period, the Probe will be switched ON via its
timer. At the time of writing, two options are being pursued for the implementation
of the revised Huygens mission. The first option includes an early switch ON of the
THE HUYGENS PROBE SYSTEM DESIGN
159
Figure 4. Cassini/Huygens Initial Orbits around Saturn. The Probe mission will be conducted on the
third orbit.
Probe to allow a long warm-up of the Probe equipment, in particular of the clock
that generates the data-stream modulation frequency. A warm-up time of 4 hours
is being studied. The second option is based on the old mission baseline (Lebreton
and Matson, 1997) that foresees Probe switch-on 25 min prior to entry.
The Probe switch-on event will activate the on-board computers, which will
then take control of the on-board operations. After system initialisation, the payload instruments will be activated in a pre-programmed sequence. A set of Probe
parameters, called the broadcast data block, will be distributed to all the payload instruments. Thus, they use the same reference parameters for sequence initialisation.
It contains such information as: Probe time, spin rate, internal temperature, altitude
and special-event flags. The Probe descent sequence will be activated based on the
detection of the entry deceleration peak. A pilot chute, and then a main chute,
will be deployed in sequence in the supersonic regime (Mach 1.5). The heat-shield
will be released 30 s after passing through Mach 1. At this point the Orbiter will be
about 2 h away from closest approach to Titan which will be about 60 000 km above
the surface. The geometry during the Probe mission is illustrated in Figure 5. Data
transmission to the Orbiter will be initiated 45 sec after deployment of the main
parachute. The housekeeping and the science data are formatted by the Probe onboard computers and transmitted to the Huygens receivers on-board the Orbiter via
the hot-redundant, two-channel, Probe-Orbiter radio link. Each telecommunication
channel is designed to support a constant data rate of 8 kbps. The data will be
received by the Huygens PSE via the Orbiter High Gain Antenna and packetized
for relay to the Orbiter’s on board computer that will store them on its solid-state
recorders for later transmission to Earth.
3. The Huygens Model Philosophy
The design and verification activities of Huygens required several development
models to be built. The Huygens model philosophy was to achieve the most com-
160
K. C. CLAUSEN ET. AL
Figure 5. Orbiter trajectory during the Probe mission. For reference, the old baseline trajectory is
also indicated.
plete verification possible that the Probe system meets the mission requirements
within the cost envelope and the tight schedule constraints imposed by the launch
window. Four models were developed at system level:
3.1. T HE STRUCTURAL , THERMAL & PYRO MODEL (STPM)
Its purpose was to qualify the Probe design (including all mechanisms activated by
pyrotechnic devices) for all structural, mechanical and thermal requirements. After
launch, the STPM is being used as an exhibition model.
3.2. T HE ENGINEERING MODEL (EM)
This model was used to verify the electrical performances of the Probe, including
the payload instruments, and to test the electrical and functional interfaces with the
Orbiter. After launch, the EM has been installed at the Huygens Probe Operations
Centre, in ESOC, Darmstadt, Germany, ESA’s Flight Operations Centre for use
as a testbed to support the Probe flight operations activities. EM payload unit
interfaces were upgraded to flight standard to increase the system reliability of
the EM testbed.
THE HUYGENS PROBE SYSTEM DESIGN
161
3.3. T HE BALLOON DROP TEST MODEL
This model was known as the ‘Special Model#2’ (SM2). Early in the programme,
another Special Model (SM1) was foreseen but eventually not built. The SM2
was used for a complete validation (demonstration) of the descent sequence in the
most realistic way achievable on Earth. The SM2 was carried aloft a stratospheric
balloon and dropped from an altitude of 35 km (Jaekel, et al., 1998). It allowed
the verification, 30 months before launch, of the design of all the mechanisms of
the descent control subsystem (heat shield separation, parachute deployment). All
SM2 mechanisms were of flight standard. After launch, the SM2 is also being used
as an exhibition model.
3.4. T HE FLIGHT MODEL (FM)
All flight units were specifically built for integration into the FM Probe. None
of the units built in the FM were used for instrumenting any of the three models
previously described.
Flight spare units of all electrical subsystems, and of all payload instruments,
were also built in order to minimise Probe refurbishment delays in case of a unit
failure during critical phases of the integration activities of the FM. After launch,
flight spare units were integrated into the EM Probe to make it function as realistically as possible like the flight model. Payload flight spare units are being maintained at respective Principal Investigator laboratories for calibration and measurement validation tests.
The main milestones and the major standard reviews carried out at ESA level
are indicated in the overall development schedule in Figure 1. Additional joint
ESA/JPL reviews were included in the development schedule as required by the
specific nature of the Orbiter/Probe interfaces. Huygens was also subjected to the
External Independent Review system put in place by NASA for Cassini/Huygens.
4. Overall Huygens Configuration
The Huygens Probe System (Clausen and Sainct, 1994; Jones and Giovanoli, 1997)
consists of two principal elements: (i) the Huygens Probe itself, the element that
will detach from the Saturn Orbiter and enter in the atmosphere of Titan; (ii) the
Probe Support Equipment (PSE), the Huygens element that will remain attached
to the Orbiter after Probe separation, and will provide the radio relay link functions with the Probe. The Huygens system has been optimised to make it robust to
uncertainties of Titan’s environment (Carton et al., 1995).
162
K. C. CLAUSEN ET. AL
Figure 6. Exploded View of the Huygens Probe. The Huygens Probe comprises the Descent Module
(DM) within the Entry Assembly (EA).
4.1. T HE H UYGENS PROBE
The mass breakdown of the Huygens Probe System is provided in Table I. The
Probe (Figure 6) consists of two elements: The aeroshell and the Descent Module.
The aeroshell is wrapped into a multi-layer thermal protection for the cruise phase.
It is made of two parts: the front-shield and the back-cover. The Descent Module
comprises two platforms, a fore-dome and an after-cone.
The Descent module is enclosed in the aeroshell like a cocoon. The aeroshell
and the descent module are attached to each other by mechanisms at three points.
The aeroshell is jettisoned after entry, releasing the Descent Module. The various
elements are described in more details below.
4.2. T HE PROBE SUPPORT EQUIPMENT (PSE)
The Probe Support Equipment consists of:
− Two redundant Probe Support Avionics (PSA) electronic boxes;
− Two redundant radio Receiver Front End’s (RFE);
− The Doppler Wind Experiment (DWE) Receiver Ultrastable Oscillator
(RUSO);
− The Spin Eject Device (SED);
− The harness (including the umbilical connector) providing power, command
and RF and data links between the PSA, Probe and Orbiter during the cruise
phase.
The Probe is installed on the Orbiter by the supporting ring of the Spin Eject
Device (Figure 7). The ring is equipped with guide rails. Spring loaded pyrotechnic
163
THE HUYGENS PROBE SYSTEM DESIGN
TABLE I
Huygens mass budget
Probe
PSE
Subsystems
FRSS
BCSS
SEPS
DCSS
ISTS
THSS
EPSS
PHSS
CDMS
PDRS
78.75
16.13
11.40
12.13
41.41
20.60
44.73
12.61
23.10
6.04
10.29
1.50
16.30
Experiments
TUSO/RUSO
SSP
GCMS
HASI
DISR
DISR cover
ACP
Fasteners, etc
Balance mass
Total
1.90
4.87
17.20
5.77
8.07
3.63
6.18
0.95
2.85
1.90
318.32
29.99
devices maintain the Probe in place on the ring. The umbilical cord links the Probe
to the Orbiter and provides all electrical connections – Electrical power, RF link,
and temperature monitoring – between the Probe and the Orbiter when they are
attached during the cruise. Upon firing at Probe separation, the umbilical will be
disconnected and the Probe will separate from the Orbiter with a small relative
velocity of 0.3 m s−1 and a spin of 7 RPM.
The overall Probe System configuration and its interfaces with the Orbiter is
shown functionally in Figure 8. The subsystem breakdown is illustrated in Figure 9.
Each subsystem is described in detail below.
164
K. C. CLAUSEN ET. AL
Figure 7. Huygens Probe Accommodation on the Orbiter (A Probe development model and the
Orbiter mechanical mock-up model are shown in this figure).
Figure 8. Huygens Probe System architecture. The acronyms used are explained for clarity. PSA:
Probe System Avionics; S/S: subsystem; TUSO: Transmitter Ultrastable Oscillator; RUSO: Receiver
Ultrastable Oscillator; HGA: (Orbiter) High Gain Antenna; RFE: Receiver Front End; TF: Transfer
Frame.
THE HUYGENS PROBE SYSTEM DESIGN
165
Figure 9. The Huygens Probe Subsystem breakdown.
5. Mechanical and Thermal Subsystems
The Huygens Probe is designed to enter into an atmosphere whose profile and
chemical composition are specified by ‘engineering models’. The design of the
aeroshell, which consists of the front shield and the back cover, is the result of
various engineering trade-off studies (Patti, 1995).
5.1. F RONT SHIELD SUBSYSTEM (FRSS)
The 79 kg, 2.7 m diameter, 60-degree half-angle coni-spherical front shield is designed to decelerate the Probe in Titan’s upper atmosphere from about 6 km s−1 at
entry to a velocity equivalent to about Mach 1.5 (∼400 m s−1 ) by around 160 km
altitude. Tiles of ‘AQ60’ ablative material – a felt of phenolic resin reinforced by
silica fibres – provide protection against the entry thermal flux up to 1.4 MW m−2 .
The shield is then jettisoned and the Descent Control Subsystem (DCSS) is deployed to control the descent of the Descent Module (DM) to the surface. The
FRSS supporting structure is a Carbon Fibre Reinforced Plastic (CFRP) honeycomb shell. It was also designed to protect the DM from the heat generated during
entry. The AQ60 tiles are attached to the CFRP structure by adhesive CAF/730.
Prosial, a suspension of hollow silica spheres in silicon elastomer, is sprayed dir-
166
K. C. CLAUSEN ET. AL
Figure 10. Huygens Parachute Deployment Sequence.
ectly on the aluminium structure of the FRSS rear surfaces, which are expected to
experience heat fluxes ten times lower than those to be experienced by the front
shield.
5.2. BACK COVER SUBSYSTEM (BCSS)
The Back Cover (BC) protects the DM during entry, and carries multi-layer insulation (MLI) for the cruise and coast. A hole in it ensures depressurisation during
Launch and repressurisation during entry. As it does not have stringent aerothermodynamic requirements, it is a stiffened aluminium shell of minimal mass (11.4 kg)
protected by Prosial (5 kg). It includes: (i) an access door for late integration and
forced-air ground cooling of the Probe; (ii) a break-out patch through which the
first (drogue) parachute is fired; iii) a labyrinth sealing joint with the Front Shield,
which provides a non-structural thermal and particulate barrier.
5.3. D ESCENT CONTROL SUBSYSTEM (DCSS)
The DCSS controls the descent rate to satisfy the scientific payload’s requirements,
and to provide the attitude stability to meet the requirements of the Probe-toOrbiter RF data link and the stability requirements of the descent imager. The
DCSS is activated nominally at Mach 1.5, at about 160 km altitude. The sequence
(Figure 10) begins by firing the Parachute Deployment Device (PDD) to eject the
THE HUYGENS PROBE SYSTEM DESIGN
167
pilot chute pack through the Back Cover’s break-out patch, the attachment pins of
which shear under the impact. The 2.59 m diameter Disk Gap Band (DGB) pilot
chute inflates behind the DM and pulls the Back Cover away from the assembly.
As it goes, the Back Cover pulls the 8.30 m diameter DGB main parachute from its
container. This canopy inflates during the supersonic phase in order to decelerate
and stabilise the Probe through the transonic regime. The Front Shield is released at
about Mach 0.6. In fact, the main parachute is sized by the requirement to provide
sufficient deceleration to guarantee a positive separation of the Front Shield from
the Descent Module. The main parachute is too large for a nominal descent time
shorter than 2.5 hours, a constraint imposed by battery capacity, communication
geometry between the Probe and the Orbiter, and thermal performances of the
DM in Titan’s atmosphere. It is therefore jettisoned after 15 min and a 3.03 m
diameter DGB stabilising parachute is deployed. All parachutes are made of kevlar
lines and nylon fabric. The main and the stabiliser chutes are housed in a single
canister on the DM’s top platform. Compatibility with the Probe’s spin is ensured
by incorporating a swivel using redundant low-friction bearings in the connecting
riser of both the main and stabiliser parachutes.
5.4. S EPARATION SUBSYSTEM (SEPS)
The Separation Subsystem (SEPS) provides: (i) mechanical attachment and electrical connection to, and separation from the Orbiter; (ii) the transition between
the entry configuration (‘cocoon’) and the descent configuration (DM under parachute). The three SEPS mechanisms are connected on one side to Huygens’ Inner
Structure (ISTS) and on the other side to the Orbiter’s supporting struts. As well
as being the Probe-Orbiter structural load path, each SEPS fitting incorporates a
pyronut for Probe-Orbiter separation, a rod cutter for front shield release and a rod
cutter for Back Cover release.
Within the SEPS, the Spin Eject Device (SED) performs the mechanical separation from the Orbiter:
− Three stainless steel springs provide the separation force;
− Three guide devices, each with two axial rollers running along a T-profile
helical track, ensure controlled ejection and spin, even in degraded cases such
as high friction or a weak spring;
− A carbon fibre ring accommodates the asymmetrical loads from the Orbiter
truss and provides the necessary stiffness before and after separation;
− Three pyronuts provide the mechanical link before separation.
In addition, the Umbilical Separation Mechanism (USM) of three 19-pin connectors, which provide Orbiter-Probe electrical links, is disconnected by the SED.
168
K. C. CLAUSEN ET. AL
5.5. I NNER STRUCTURE SUBSYSTEM (ISTS)
The ISTS provides mounting support for the Probe’s payload and subsystems. It is
fully sealed except for a vent hole of about 6 cm2 on the top. It consists of:
− A 73 mm thick aluminium honeycomb sandwich experiment platform which
supports the majority of the experiments and subsystems units, together with
their associated harnesses;
− A 25 mm thick aluminium honeycomb sandwich top platform which supports
the Descent Control Subsystem and the two Probe RF transmitting antennas,
and forms the DM’s top structure;
− The After Cone and Fore Dome aluminium shells, linked by a central ring;
− Three radial titanium struts, which interface with the SEPS and provide thermal
decoupling between the Probe and the Orbiter, while three vertical titanium
struts link the two platforms and transfer the main parachute deployment
loads;
− 36 spin vanes on the Fore Dome’s periphery, which provide spin control
during descent through aerodynamic interaction with the atmosphere;
− The secondary structure for mounting experiments and equipment.
5.6. T HERMAL SUBSYSTEM (THSS)
The PSE is thermally controlled by the Orbiter. The Probe’s thermal subsystem
(THSS) must maintain all experiments and subsystem units aboard the Probe within
their allowed temperature ranges during all mission phases. In the vacuum of space,
the THSS partially thermally insulates the Probe from the Orbiter. It ensures only
small variations in the Probe’s internal temperatures, despite variation in the solar
flux from 3800 W m−2 (near Venus, but only during short periods as the Probe
is normally shadowed under the Orbiter’s High Gain Antenna) to 17 W m−2 (approaching Titan).
As shown in Figure 11, Probe thermal control is achieved by:
− A Multi-Layer Insulation (MLI) blanket surrounding all external areas, except
for the small ‘thermal window’ in the Front-Shield (see below);
− 35 Radioisotope Heater Units (RHUs) on the experiment platform and the top
platform providing about 1 W each all the time;
− A white-painted 0.17 m2 thin aluminium sheet on the front shield’s forward
face which acts as a controlled heat leak (about 8 W during cruise). It reduces
the sensitivity of thermal performances to the MLI efficiency.
The MLI is burned and torn away during entry. The temperature is controlled by
the ‘AQ60’ high-temperature tiles on the front-shield’s front face, and by Prosial
on the front shield’s aft surface and on the Back Cover. During the descent phase,
thermal control is provided by foam insulation and gas-tight seals. Lightweight
open-cell Basotect foam covers the internal walls of the DM’s shells and the top
platform. This prevents convective cooling by Titan’s cold atmosphere (70 K at
THE HUYGENS PROBE SYSTEM DESIGN
169
Figure 11. The Probe’s thermal control system. RHU: Radioisotope Heater Unit; MLI: Multi Layer
Insulation.
Figure 12. Huygens Probe Electrical Power Subsystem (EPSS). BDR: Battery Discharge Regulator;
SSPS: Solid State Power Switch; The power lines (POWs) from the Orbiter to BDR’s sections are
called: Pow1: SSPS1 to BDR1; POW2: SSPS 2 + SSPS 3 to BDR 2; POW3: SSPS 4 to BDR 3;
POW4: SSPS 5 + SSPS 6 to BDR 4; POW5: SSPS 7 to DBR 5.
45 km altitude, 94 K on the surface) and it decouples the units mounted on the
experiment platform from the cold aluminium shells. Gas-tight seals around all
elements protruding through the DM’s shell minimise gas influx. In fact, the DM
is gas tight except for a single 6 cm2 hole in Top Platform that allow equalisation
of pressure during launch and entry through the atmosphere of Titan.
170
K. C. CLAUSEN ET. AL
6. Electrical Power Subsystem (EPSS)
6.1. D ESCRIPTION
As shown in Figure 12, the Electrical Power Subsystem (EPSS) consists of three
main elements which will now be discussed.
6.1.1. Batteries
Five batteries provide the mission’s electrical power. Each battery consists of two
modules of 13 Li SO2 (7.6 Ah) cells in series. The expected utilisation of the
available battery energy during the mission (no pre-heating option) is detailed in
Table II. The pre-heating option of the recovery mission requires an additional
400 Wh, which is available thanks to ample margin available if all 5 batteries are
healthy.
6.1.2. The Power Conditioning & Distribution Unit (PCDU)
The PCDU conditions the power and distributes it via a regulated main bus, with
protection to ensure uninterrupted operations even in the event of a single failure
inside or outside the PCDU.
During the cruise, electrical power is provided by the Orbiter. The PCDU isolates the batteries. The five interface circuits connected to the Orbiter’s Solid State
Power Switches (SSPSs) provide Probe-Orbiter electrical isolation and voltage
conversion between the SSPS output and the input of the PCDU’s Battery Discharge Regulator (BDR) circuits. The BDRs adapt the power from either the Orbiter or the batteries and generate the 28 V for the bus. This is controlled by a
centralised Main Error Amplifier (MEA). The power is distributed by active current
limiters. The current limitation level is set for each user and with ON/OFF switching capability. The Mission Timer, however, is supplied by three switchable battery
voltage lines through series fuses or, when the PCDU is powered by the Orbiter,
by dedicated output voltage lines of the Orbiter interface circuits. The PCDU also
provides a protected +5 V power supply used by the Pyro unit to generate the
bi-level status telemetry of the selection relays and for the activation circuit that
switches ON the Pyro unit’s power intercept relay.
6.1.3. The Pyro Unit (PYRO)
The pyro unit consists of two redundant sets of 13 pyro lines, directly connected
through protection devices to the centre tap of two batteries. Safety requirements
are met by three independent levels of control relays in series, as well as by active
switches and current limiters controlling the firing current (Figure 13). The three
series relay levels are: (i) energy intercept relay (activated by PCDU at the end
of the coast phase); (ii) arming relays (activated by the arming timer hardware
triggered by a measured deceleration threshold during entry); (iii) selection relays
(activated by Command and Data Management Unit, CDMU, software). In ad-
171
THE HUYGENS PROBE SYSTEM DESIGN
TABLE II
Huygens nominal battery energy budget
PDRS (on Probe)
CDMS
EPSS (incl. Pyro)
Payload
PCDU losses
Harness losses (0.5%)
Power total
Coast
(22 days)
Pre-entry
entry
(18 min)
(W)
(W)
0.272
0.272
10.98
26.39
1.65
60
25
0.50
125
Descent
w/o
proximity
sensor
(80 min)
(W)
Descent
with
proximity
sensor
(73 min)
(W)
82.61
26.39
1.65
180
47.3
1.45
82.61
37.73
1.65
180
47.3
1.51
339
351
Energy
(Wh)
214
246
5
325
128
4
Pre-separation checks
Required Energy (nominal)
Failure assumed: single Probe unit fails ON
: single experiment fails ON
Required Energy (assuming failed
units)
Available Energy (assuming failed
batteries)
Energy loss due to assumed battery 1 string (of 10) failed
failures:
1 cell (of 5) in each string failed
Worst-case energy loss due
to 7-year storage in cruise
50
972
85
110
1167
NOMINAL BATTERY CAPACITY
(5 fresh batteries)
2059
1184
355
520
PDRS: Probe Data Relay System; CDMS: Command and Data Management System; EPSS:
Electrical Power Subsystem; PCDU: Power Conditioning and Distribution System.
dition, safe/arm plugs were provided on the unit itself for safety during ground
operations.
6.2. I N - FLIGHT OPERATIONAL MODES
The configuration of the EPSS depends upon which operational mode the Probe is
in. The following configurations are available:
172
K. C. CLAUSEN ET. AL
Figure 13. Configuration of the Huygens Probe pyro unit. BCM: Back Cover Mechanism; CDMU:
Command and Data Management Unit; HL O/O: High Level On/Off; I/F: Interface; PCDU: Power
Conditioning & Distribution Unit; SL: Switch and Limiter; SS; Subsystem; TC: telecommand; TLM:
Telemetry.
6.2.1. Cruise
The EPSS is OFF during the whole cruise, except for periodic Probe checkout
operations. There is no power at the Orbiter interface and direct monitoring by the
Orbiter allows verification that all the relays are open.
6.2.2. Cruise Probe checkout
The EPSS is powered by the Orbiter for cruise Probe checkout operations. The
28 V bus is regulated by the EPSS BDRs associated with each Orbiter SSPS; a
total of 210 W is available from the Orbiter and all the relays are open. In addition
52 W are available from the Orbiter to power the PSE.
6.2.3. Mission Timer loading
Following the loading (through the Orbiter) of the expected coast time duration
into the Mission Timer Unit, battery ‘depassivation’ is performed to overcome
any energy loss due to chemical passivation process during cruise. Before Probe
separation, the EPSS timer relays are closed to provide electrical power to the
Mission Timer Unit from the batteries and the Orbiter power is switched OFF.
6.2.4. Coast
Only the Mission Timer Unit is supplied electrical power by the batteries through
specific timer relays during the coast phase. The EPSS is OFF and all other relays
are open.
THE HUYGENS PROBE SYSTEM DESIGN
173
Figure 14. The Probe’s Control and Data Management Subsystems (CDMSs). CASU: Central Acceleration Sensor Unit; CDMU: Command and Data Management Unit; HASI: Huygens Atmospheric
Structure Instrument; I/F: Intermediate Frequency; PSA: Probe Support Avionics; RASU: Radial
Acceleration Sensor Unit; TC: Telecommand; TM: Telemetry.
6.2.5. Probe Wake-up
At the end of the coast, the Mission Timer Unit wakes-up the Probe by activating
the EPSS. Input relays are closed and the current limiters powering the CDMU
are automatically switched ON as soon as the 28 V bus reaches its nominal value
(other current limiters are initially OFF at power up). The pyro energy intercept
relay is also automatically switched ON by a command from the PCDU.
6.2.6. Entry and Descent
All PCDU relays are closed and the total power (nominally 300 W; 400 W maximum) is available on the 28 V distribution outputs to subsystems and instruments.
The Pyro Unit performs the selection and the firing of the squibs, activated by
CDMU commands.
7. Command and Data Management Subsystem (CDMS)
The data handling and processing functions are divided between the Probe Support
Equipment (PSE) on the Orbiter and the CDMUs (part of the CDMS) in the Probe
174
K. C. CLAUSEN ET. AL
(Figure 14). The Probe Data Relay Subsystem (PDRS) provides the RF link function for this purpose, together with the data handling and communication function
with the Orbiter’s Control and Data Subsystem (CDS) via a Bus Interface Unit
(BIU). During the ground operations and cruise checkouts, the Orbiter-Probe RF
link is replaced by an umbilical connection. The CDMS has two primary functions:
(i) autonomous control of Probe Operations after separation; (ii) management of
data transfer from the equipment, subsystems and experiments to the Probe transmitters for relay to the Orbiter. For these functions, the CDMS uses the Probe
On-board Software (POSW), for which it provides the necessary processing, storage and interface capabilities. The driving requirement of the CDMS design is such
that it is intrinsically single point failure-tolerant. As a result of the highly specific
Huygens mission (limited duration and no access by telecommand after separation), a very safe redundancy scheme has been selected. As shown in Figure 14,
the CDMS therefore consists of:
− Two identical CDMUs;
− A triply redundant Mission Timer Unit (MTU);
− Two mechanical g-switches (backing up MTU);
− A triply redundant Central Acceleration Sensor Unit (CASU);
− Two sets of two mechanical g-switches (backing up CASU);
− A Radial Acceleration Sensor Unit (RASU) with two accelerometers;
− Two Radar Altimeter proximity sensors, each consisting of separate electronics, transmitting antenna and receiving antenna.
The two CDMUs each execute their own Probe Operations Software (POSW)
simultaneously and are configured with hot redundancy (Chain A and Chain B).
Each hardware chain can run the mission independently. They are identical in
almost all respects; the following minor differences facilitate simultaneous operations and capitalize on the redundancy:
− The telemetry is transmitted at two different RF carrier frequencies (resp.
2040
and
2097.955 MHz);
− The chain B telemetry is delayed by about 6 s to avoid loss of data should
a temporary loss of the telemetry link occur (e.g., due to an antenna mispointing as the Probe swings back and forth beneath the parachute).
Each CDMU chain incorporates a health check (the results are reflected in the
‘Processor Valid’ status flag) which is reported to the experiments in the Descent
Data Broadcast (DDB) message. A chain declares itself invalid when two bit errors
in the same memory word, an ADA exception or an under-voltage on the 5 V line
occurs within the CDMU.
7.1. C OMMAND AND DATA MANAGEMENT UNIT (CDMU)
Each CDMU includes a MAS 281 16-bit 1750A micro-processor running at
10 MHz, with 64 kword PROM storing the POSW and 64 kword RAM used for the
THE HUYGENS PROBE SYSTEM DESIGN
175
POSW and other dynamic data when the CDMU is ON. A memory management
unit was implemented for providing memory flexibility and some growth potential
during development. Direct Memory Access (DMA) is provided to facilitate data
transfer between the memory and the input/output registers, thus relieving the microprocessor of repetitive input/output tasks. The RAM-stored program memory
is protected against single error occurrence by an Error Detection And Correction (EDAC) device, which detects and corrects single bit errors and reports any
double bit errors to the Processor Valid function. TM/TC management is based
on an internal On Board Data Handling (OBDH) bus in order to standardize the
internal interfaces, which are based on the classical Central Terminal Unit (CTU)
and Remote Terminal Units (RTUs) approach. In addition to conventional CDMS
functions, the CDMUs implement the following Huygens-specific functions:
− The arming timer function which sends pyro arming commands following a
specific hardware-managed timeline, thus offering full decoupling from the
POSW operation;
− Sending of the Processor Valid signal to payload experiments via the Descent
Data Broadcast (DDB), indicating the health of the nominal CDMU (unit A);
− Reprogrammability through the use of 16 kword of Electrically Erasable
PROM (EEPROM), thus allowing patching of the POSW if necessary;
− EDAC error count reports on internal data transfers;
− Capability, through specific 16 kword of RAM, to delay one telemetry chain
by a few seconds.
7.2. M ISSION TIMER UNIT (MTU)
The MTU is used to activate the Probe at the end of the coast phase. In order
to obtain a single point failure-free design, it is based on three independent hot
redundant timer circuits followed by two hot-redundant command circuits. Two
mechanical g-switches provide a backup to the MTU. MTU electrical power is
supplied directly via three 65 V supply lines, one for each timer board, from independent batteries. During the pre-separation programming activities, when the
Probe is still connected to the Orbiter, all three timers are programmed with the
exact predicted duration of the coast phase via serial memory load interfaces from
one of the two CDMUs. Each of the three timer boards can be loaded independently
from either CDMU. The programmed values can be verified by the serial telemetry
channels. When the MTU programming activity is finished, the CDMUs and all
other Probe systems except the MTU are turned off. The Probe is separated a few
days later. During the coast of about 22 days, the programmed timer register is
decremented by a very precise clock signal. The MTU consumes about 300 mW
during this period as only the necessary circuits (CMOS-based) are powered. When
the command board majority voting detects either both g-switches active or at least
two of the three ‘time-out’ signals received, five High Level Commands (HLCs)
are issued sequentially from each board to the PCDU in order to switch on both
176
K. C. CLAUSEN ET. AL
CDMUs. The timer then returns to a standby mode. The two g-switches, which
ensure Probe wake-up in the event of atmospheric entry without the time-out signal from any of the timer boards, are purely mechanical devices that close when
deceleration reaches a level of 5.5–6.5 g.
7.3. C ENTRAL ACCELERATION SENSOR UNIT (CASU)
The CASU measures axial deceleration at the centre of the experiment platform
during entry. The signal is processed by the CDMU to calculate the time for parachute deployment (To). The CASU operates within 0–10 g and uses a scale factor
of 0.512 V g−1 . Its main building blocks are:
− Power circuit: two hot-redundant input power lines make it single point failuretolerant in both the nominal and the redundant power line;
− Three accelerometer analogue signal conditioning blocks. A low-pass filter
with a 2 Hz cut-off is used and the analogue output from each block is routed
to both CDMUs.
In addition, the design prevents failure propagation from one conditioning chain
to the other; it withstands permanent short circuit conditions without any degradation; and it is single-point failure-tolerant to the input power supply line.
Back-up detection of To is performed separately for both CDMUs by two pairs
of mechanical g-switches in case the prime CASU system is inoperative. The
threshold values for each pair of g-switches are 5.5 g and 1.2 g.
7.4. R ADIAL ACCELERATION SENSOR UNIT (RASU)
The RASU measures radial acceleration at the periphery of the experiment platform. The signal is processed by the CDMU’s to provide the Probe spin rate for
insertion into the DDB distributed to experiments. The RASU is designed to measure spin acceleration within 0–120 mg with a 41.67 V g−1 scale factor. The design
is based on the CASU unit but it includes only two accelerometers.
7.5. R ADAR ALTIMETER UNIT (RAU)
The RAU proximity sensor uses two totally redundant altimeters operating with
frequency-modulated carrier wave at 15.4 GHz and 15.8 GHz for measuring the
altitude above Titan’s surface, starting from about 25 km. Each of the four antennas
(two per altimeter) is a planar slot radiator array providing an antenna gain of 25 dB
with a symmetrical full beam width of 7.9◦ . A continuous signal modulated in frequency with a rising and falling ramp waveform is transmitted; the received signal
has a similar form, but delayed by the two-way propagation time after reflection
on Titan’s surface. Hence the range to the target (Titan’s surface) is proportional
(with a linear frequency modulation ramp) to the instantaneous frequency shift
between the transmitted and received signals. The received signal waveform is also
THE HUYGENS PROBE SYSTEM DESIGN
177
Figure 15. The Probe Data Relay Subsystem (PDRS) in mission phase configuration. ACP: Aerosol
Collector and Pyrolyser; CDMU: Command and Data Management Unit; HASI: Huygens Atmospheric Structure Instrument; DISR: Descent Imager/Spectral Radiometer; DWE: Doppler Wind
Experiment; GCMS: Gas Chromatograph Mass Spectrometer; LNA: Low Noise Amplifier; ORT:
Orbiter Receiving Terminal; PTA: Probe Transmitting Antenna; RA; Radar Altimeter; SSP: Surface
Science Package; RUSO: Receiver Ultrastable Oscillator; SBT: S-Band Transmitter; DH: Data Handling; CDS: Command and Data System; TUSO: Transmitter Ultrastable Oscillator; HGA: High Gain
Antenna.
provided to the Huygens Atmospheric Structure Instrument (HASI) for further on
board processing for establishing Titan’s surface roughness and topography.
8. Probe Data Relay Subsystem (PDRS)
The PDRS (Figure 15) is Huygens’ telecommunications subsystem, combining
the functions of RF link, data handling and communications with the Orbiter. It
transmits science and housekeeping data from the Probe to the Huygens PSE on
board the Orbiter, which are then relayed to the Orbiter CDS via a Bus Interface
Unit. In addition, the PDRS is responsible for telecommand distribution from the
Orbiter to the Probe by umbilical during the ground and cruise checkouts. The
PDRS consists of:
− Two hot-redundant S-band transmitters and two circularly polarised Probe
Transmitting Antennas (PTAs) on the Probe;
− A Receiver Front End (RFE) unit (enclosing two Low Noise Amplifiers and a
diplexer) and two Probe Support Avionics (PSA) units on the Orbiter.
The Orbiter’s High Gain Antenna (HGA) acts as the PDRS receiving antenna.
In addition, as part of the Doppler Wind Experiment (DWE), two ultra stable
oscillators – The Transmitter Ultra Stable Oscillator (TUSO) on the Probe and the
178
K. C. CLAUSEN ET. AL
Receiver Ultra Stable Oscillator (RUSO) on the Huygens PSE – are available as reference signal sources to allow the accurate measurement of the Doppler frequency
shift in the Probe-Orbiter RF carrier signal. The PDRS electrical architecture is
fully channelised for redundancy, except that TUSO and RUSO are connected to
only one chain (chain A).
The RF signal is composed of a residual carrier signal (at either 2040 or
2097.955 M Hz) that is phase-modulated by a subcarrier signal at 131 072 Hz.
The data-stream is PCM encoded on the subcarrier. The symbol stream rate is
16384 symb s−1 . The signal data rate is 8192 bit per second. The clock driving
the carrier frequency is either a Temperature Controlled Oscillator (TCXO) or
an instrument-provided Ultrastable Oscillator (on channel A only). A dedicated
CDMU temperature-controlled crystal provides the reference frequency for the
subcarrier and data modulation clock.
8.1. P ROBE SUPPORT EQUIPMENT (PSE)
8.1.1. Receiver Front End (RFE)
The RFE is comprised of:
− Two Low Noise Amplifiers (LNAs) linked to the Orbiter’s HGA to amplify
the acquired RF signal by 20 dB using two cascaded FET stages;
− Two RF inputs: one linked to the HGA, the other via a coupler and used during
checkout to link a dedicated transmitter output (on the Probe) to the RFE via
the umbilical;
− A pre-selection filter (coaxial cavity type with six poles);
− An isolator;
− An output attenuator (fixed value).
In addition, owing to the HGA’s shared use with the Orbiter, a bandpass filter
(the TX filter) and a circulator protect the LNA chain B by isolating the Orbiter’s
S-Band Transmitter (SBT) and the Probe’s S-band receiver, which both use the
HGA. These two modes are mutually exclusive.
8.1.2. Probe Support Avionics (PSA)
The two RFE outputs are sent to the two redundant PSAs, which perform detection, acquisition (based on a 256-point Fast Fourier Transform algorithm), tracking,
signal demodulation and data handling and management. The PSA data handling
architecture is divided between analogue and digital sections. The analogue section
performs signal down-conversion from S-band to the IF frequency. The IF signal
is digitized and the samples processed by the digital section. The digital section
performs:
− Digital Signal Processing (DSP), i.e. the signal acquisition and tracking task
based on FFT analysis and frequency acquisition;
− Viterbi decoding of the digital signal and delivery of the decoded transfer
frame to the data handling section at 8192 bit/s
THE HUYGENS PROBE SYSTEM DESIGN
−
−
−
−
−
179
Data handling, that consists of:
• Transforming the received transfer frame into a telemetry packet;
• Generating internal PSA housekeeping data (including the synthesised frequency information) in a packet format controlling and managing communications with the Orbiter CDS via a Bus Interface Unit (BIU);
• Distributing the telecommands from the Orbiter BIU interface.
The digital section is composed of the following main modules:
The receiver digital module, consisting of the UT1750 microprocessor,
8 kword RAM and 8 kword PROM, and the receiver signal processing ASIC;
The interface digital module, using GaAs devices for Numerically Controlled
Oscillator (NCO) and Digital to Analogue Converter (DAC) functions;
The Support Interface Circuitry (SIC) module, which comprises: (i) the
8 kword EEPROM to memorise software patches; (ii) the 32 kword PROM
containing the Support Avionics Software (SASW) and the testing, telecommand, telemetry and umbilical interfaces; (iii) the MAS 281 microprocessor
module used by the SASW;
The BIU module that controls communications between the PSA and the
Orbiter’s 1553 bus.
8.2. P ROBE TRANSMITTING TERMINAL (PTT)
The PTT is comprised of two transmitters and two Probe antennas. Each transmitter
includes a Temperature Controlled Crystal Oscillator (TCXO), a synthesiser and
BPSK modulator module, and a 10 W Power Amplifier module using Automatic
Level Control (ALC) for 40.2 dBm nominal output power (end-of-life, worst-case,
including ageing). The reference oscillator for the Phase Locked Loop (PLL) synthesiser is either an (internal) Voltage Controlled Crystal Oscillator (VCXO) with
a temperature compensating network or the (external) TUSO signal. The selection
between these reference sources is made before separation from the Orbiter. The
TUSO will be selected unless a failure is detected in it before separation.
The two transmitting antennas linked to the transmitters (dual chains without
cross-coupling) are quadrifilar helix designs. The four spirals are fed at the bottom of the helix in phase quadrature. Left Hand Circular Polarisation (LHCP) is
used for signal transmission at 2040 MHz and Right Hand Circular Polarisation
(RHCP) for transmission at 2097.955 MHz. The minimum gain for the antennas,
mounted on the top platform, is 1.6 dB (channel A) and 1.8 dB (channel B) at
all Probe-Orbiter aspect angles between +20◦ and +60◦ . The transmitting antenna
gain varies as a function of the azimuth and elevation angle as shown in Figure 16.
180
K. C. CLAUSEN ET. AL
Figure 16. Probe Transmitting antenna pattern envelope as function of the elevation angle.
Figure 17. Probe-Orbiter radio communication link functional block diagram.
8.3. H UYGENS RECEIVER ANOMALY
8.4. A NOMALY OVERVIEW
The main component of the Huygens-to-Cassini communications link are shown
at high level in Figure 17.
The symbol Synchronizer is a classical Data-Transition-Tracking-Loop (DTTL).
A design fault in the DTTL results in poor phase tracking (and ultimately cycle
slipping) in the DTTL. The Viterbi decoder’s synchronization performance depends on certain settings that are controlled by the Frame Synchronizer, which is
implemented in the PSA as a four-state machine. The data corruption mechanism
depends strongly on the behavior of this finite state machine as well as its coupling
to the Viterbi Decoder’s node synchronization settings.
The Huygens communications link anomaly and its consequences are illustrated
in Figure 18. The bit synchronizer has a bandwidth which is too narrow to accommodate the Doppler shift of the data stream frequency, due to relative Orbiter-Probe
motion. At a certain combination of parameters frequency offset (fs ), signal to
noise (Es /N0 ) and data transition density (Pt ) cycle slips occur. These cycle slips
THE HUYGENS PROBE SYSTEM DESIGN
181
Figure 18. Link anomaly and its consequences which result in data corruption.
cause data corruption, on board synchronization detection failures and on ground
decoding failures.
8.5. H UYGENS RECOVERY APPROACH
Cycle slips depend on the combination of three parameters: fs , Es /N0 and Pt in a
perfectly deterministic way. The first two parameters depend on the relay link geometry, thus the mission profile. It is also possible to shift the transmitted frequency
by controlling the temperature of the temperature controlled crystal oscillator in
the CDMU (see section 8). It requires switching ON the Probe a few hours prior
entry. A 4-hour pre-heating option is being considered. The third paramater, Pt , can
only be varied by inserting strings of ‘zeros’ in the data stream, thus at the expense
of the effective science data rate. The proposed solution makes use of adjustments
of the 3 parameters. The mission recovery profile is further discussed in Lebreton
and Matson, 2002.
9. Software
9.1. S OFTWARE CONCEPT
The Huygens software consists of that running in the Probe CDMS, referred to
as Probe On-Board Software (POSW), and that within the PSA on the Orbiter,
referred to as the Support Avionics Software (SASW). Two copies of the data
handling hardware (CDMU and PSA) run identical copies of POSW and SASW.
There is no cross-trapping between the two chains. The software is based on a topdown hierarchical and modular approach using the Hierarchical Object-Oriented
Design (HOOD) method and, except for some specific, low-level modules, is coded
in ADA. The software consists, as much as possible, of a collation of synchronous
processes timed by a hardware reference clock (8 Hz repetition rate). In order
to avoid unpredictable behaviour, interrupt-driven activities are minimised. Such
a design also allows a better visibility and reliability of the software. Limited
182
K. C. CLAUSEN ET. AL
reprogramming capability is provided to accommodate POSW modifications and
RAM failure recoveries. The processes are designed to use data tables as much as
possible. Mission profile reconfiguration and polling of experiment science-data
packet can be changed only by modifying these tables. This is possible via the
use of an Electrically Erasable Programmable Read Only Memory (EEPROM). In
order to avoid a RAM modification while the software is running (which can lead
to unpredictable behaviour and unnecessary complexity), direct RAM patching is
forbidden. The POSW communicates with the SASW in different ways depending
on mission phase. Before Probe separation, the two software subsystems communicate via an umbilical that provides both command and telemetry interfaces.
The Huygens Probe cannot be commanded after separation, and its telemetry is
transmitted to the Orbiter via the PDRS RF link. A certain degree of autonomy
was designed into the software that will allow it to adapt the mission profile to the
Titan environment (Dechezelles et al., 1994).
The overall operational philosophy is that the software controls the nominal
mission from power-up without checking its hardware environment or the Probe’s
connection or disconnection. The specific software actions or inhibitions required
for ground or flight checkout must therefore be invoked by special procedures,
activated by the delivery of specific telecommands to the software. To achieve this
autonomy, POSW’s in-flight modification is autonomously applied at power-up
by using a non-volatile EEPROM. At power-up, the POSW validates the CDMU
EEPROM structure and then applies any software patches stored in the EEPROM
before running the mission mode. If the EEPROM proves to be invalid at start-up,
no patches are applied and the software continues based on the software stored in
the CDMU ROM. A number of other checks are also carried out at start-up (e.g. a
DMA check and a main ROM checksum), but the software will continue execution
attempts even if the start-up checks fail.
At the time of writing, POSW modifications (software patches) are under study
as part of the on-going work related to the implementation of the revised Huygens
mission scenario. S/W patches will be applied to both chains. Those patches will
be loaded in the EEPROM’s before Probe separation. The overall reliability of
the S/W patches loading and the consequences at mission level of an unsuccessful
patch loading on either chain are being assessed as part of the decision process for
implementing the pre-heating option.
9.2. POSW FUNCTIONS
The three functions of the POSW are described below.
9.2.1. Probe Mission Management
− Detecting time T0 as entry begins, based on the Central Accelerometer Sensor
Unit (CASU) signals;
THE HUYGENS PROBE SYSTEM DESIGN
−
−
183
Forwarding commands at the correct times to the subsystems and experiments
according to the pre-defined mission timeline;
Computation of the Probe dynamical state from sensor readings sending Descent Data Broadcasts to the experiments.
9.2.2. Telemetry Management
− Collecting and recording housekeeping data;
− Generation of housekeeping packets from the housekeeping data;
− Collecting experiment packets according to a pre-defined polling scheme;
− Transmitting transfer frames to the PDRS.
9.2.3. Telecommand Management
− Reception of TC packets from the PSE (only while attached to the Orbiter);
− Execution of commands related to these TC packets;
− Forwarding of commands to the experiments.
9.3. POSW OPERATIONS
Control of the Probe, which involves the activation and forwarding of commands
to experiments and subsystems, is driven by a pre-defined set of tables called the
Mission Timeline Tables (MTTs). They define the actions to be performed as a
function of time. The pre-To MTT is activated at Probe wake-up. It controls the
Probe until the post-T0 MTT is activated by the POSW’s detection of To. The
experiments perform most of their activities autonomously based on the mission
phase data computed within the POSW and sent to all the experiments every 2 s
as a Descent Data Broadcast (DDB) packet. The DDB contains the time, spin rate
(computed by the POSW from the RASU signal or, in the event of failure, from a
pre-defined look-up table) and altitude (initially taken from a look-up table based
on the time elapsed since T0 , but later in the descent by processing RAU data). The
telemetry management function involves the acquisition and transmission of Probe
telemetry as packets. Whether they are housekeeping or experiment packets, they
are all 126 bytes long. They are forwarded to the SASW in the form of transfer
frames comprising header information followed by seven packets and then ReedSolomon code words, making a total frame size of 1024 bytes. Housekeeping data
are acquired from the subsystems (and from the software itself) at different rates
according to a pre-determined packet layout, and are loaded into four packets every
16 s. One of the packet types is buffered and issued 6.4 min later as ‘History’
housekeeping for transmitting information acquired during the entry phase when
the radio link is not established. Experiment data are acquired according to a
pre-defined polling strategy and the resulting packets are loaded into the transfer
frames.
The selection of the appropriate type of telemetry packet to include in each of
the seven slots in a frame is managed by the polling sequence mechanism on a
184
K. C. CLAUSEN ET. AL
Figure 19. Payload telemetry sharing among the five instruments that provide science data packet.
The sixth instrument, DWE provides only HK data that are embedded to the Probe System HK data
packets.
major acquisition cycle of 16 s (equal to 128 Computer Unit Times) driven by the
Polling Sequence Table (PST) and the Experiment Polling Table (EPT). The PST
defines if housekeeping or experiment packets are to be included in the transfer
frame currently under construction. However, it does not select which experiment
is to be included. The EPT defines a prioritised scheme for the collection of experiment data. The table is invoked whenever the PST requests experiment data for
the transfer frame and is read in a cyclical manner. It consists of a sequential list
of the payload experiments, with the number of occurrences of each experiment in
the table providing the polling priority. By this method, the CDMS and the POSW
are protected against failure modes in the experiments that could affect the data
production rates. Each experiment is guaranteed an opportunity to supply data at,
as a minimum, its nominal data rate. Furthermore, this polling scheme automatically optimises the data return by reallocating the TM resource in the absence of a
‘packet ready’ status flag from an experiment when expected. Three EPTs provide
different polling priorities during the descent’s various stages, switching from one
table to the next at a pre-set time, Figure 19.
9.4. SASW FUNCTIONS
The SASW’s main purpose is to provide communications between the Probe and
Orbiter. For the SASW, there is no difference between receiving Probe telemetry
via the umbilical or via the RF subsystem. All the differences are handled by the
THE HUYGENS PROBE SYSTEM DESIGN
185
PDRS receiver part of the PSA equipment. The SASW provides the following
functions:
9.4.1. Telecommand Management
− Reception of TC packets from the BIU that interfaces with the Orbiter CDS;
− Execution of commands related to these TC packets;
− Forwarding TC packets to the CDMS (including experiment telecommands)
while attached to the Orbiter.
9.4.2. Telemetry Management
− Collecting PSE housekeeping data;
− Transmitting PSE housekeeping packets and modified CDMS frames to the
Orbiter via the BIU.
9.5. SASW OPERATIONS
Communication between the SASW and the Orbiter CDS is via a MIL-STD-1553
bus using a BIU. Received telecommands are placed in BIU memory for the SASW
to read; the SASW places telemetry packets in BIU memory for transmission by the
BIU over the Orbiter’s CDS bus. The SASW examines any received telecommands
to determine their destination address. Those destined for the Probe (subsystems
or experiments) are transmitted over the umbilical TC link. Those for the PSA are
handled by the SASW. The SASW handles the reception of Probe telemetry via a
Frame Data Interface (FDI). Telemetry from the Probe is transmitted to the SASW
either by the umbilical RF link when the probe is connected or by the Probe Relay
Link (PRL) after separation. The SASW also generates its own telemetry in the
form of housekeeping packets, containing PSA status information and status data
collected from the PDRS subsystem.
10. Probe in-flight commissioning
10.1. B I - ANNUAL IN - FLIGHT PROBE CHECKOUTS
Following the launch of the Cassini/Huygens spacecraft on 15 October 1997, inflight checkouts have been successfully carried out about every 6 months. A maximum time lapse between two successive checkouts is 8 months as required for
instrument maintenance activities and system constraints. Overall, the performance
of the Probe subsystems and of the payload during the checkout activities has been
nominal. The first three Probe checkouts have been carried out in the nominal
attitude configuration of the Cassini/Huygens spacecraft that is flown in the inner
Solar System; i.e. in the High Gain Antenna-to Sun attitude. Solar radio noise
picked up by the HGA injected noise in the Huygens receivers. A Huygens receiver
186
K. C. CLAUSEN ET. AL
Figure 20. This figure illustrates the history of the Huygens receiver AGC signal strength variation
during the in-flight checkouts. The strong variation of the AGC observed during the first four checkouts is due to the effect of the solar noise that depends upon the distance to the Sun. The observed
modulation during a checkout is due to the spacecraft attitude that modulates the solar noise intensity
picked up by Cassini High Gain Antenna.
calibration test sequence was executed on 28 May 1998 with the HGA turned away
12◦ away from the Sun. This test was successful and allowed to confirm the health
of the Huygens receivers. The history of the radio receiver AGC measurements
obtained during the first in-flight checkouts is illustrated in Figure 20.
10.2. E ND - TO - END PROBE RELAY TEST
An End-to-End Probe Relay Test was performed in February 2000 with the objective of verifying and calibrating the performance of the receivers. The NASA
Deep Space Network DSS-24 Goldstone station was used to transmit radio signals
mimicking the ones expected to be transmitted by the Probe during its descent.
This end-to-end test uncovered unexpected behaviour by both Huygens receivers
while receiving Mission representative data transmission.
10.3. P ROBE THERMAL PERFORMANCE DURING CRUISE
The Orbiter is continuously monitoring key Probe temperatures during the whole
Cruise phase. The first years of temperature measurements of the Huygens Probe
and of its interfaces with the Cassini Saturn Orbiter is plotted in Figure 21. The
thermal performances of the Huygens Probe are within a few degrees of the preflight predictions. It demonstrates the robustness of the Huygens Probe Thermal
design, (Cluzet et al., 1998). The excellent thermal performances of the Probe
during the first 3 years allowed the Probe to be used as a secondary heat-shield
for the whole spacecraft during the jovian observation campaign.
11. The Probe EM at HPOC/ESOC
The Huygens Flight Operations are conducted from the Huygens Probe Operations
Centre (HPOC), ESOC, Darmstadt, Germany (Sollazzo et al., 1997). The one-time
THE HUYGENS PROBE SYSTEM DESIGN
187
Figure 21. Huygens Probe Temperature variation during the cruise during the first 8 months in 2000.
The increase in temperature at the Probe-Orbiter interface (curves labelled SEPS 1 to 4), and in the
Probe interior (curve labelled PCDU1 and PCDU2), which occurs on DOY 30, is due to the transition
from HGA-to-Sun to HGA-to-Earth. The predicted temperatures are also shown for about one month
after the transition to the attitude HGA-to-Earth. The measured temperatures are a few degrees lower
than predicted.
occurrence nature of the Huygens mission called for special ground facilities for
testing and validating any modification of the on-board software that may be required as part of the bi-annual checkout activities and also for Probe configuration
prior to its release.
The Huygens Engineering Model (see section 3 above), has been refurbished by
the inclusion of flight-spare units and hardware upgrades to make it representative
of the Flight Model Probe. It resides at HPOC, (Figure 22), to support the inflight operations activities. It is used to rehearse any modified checkout sequence.
Should it be required, it will be used as a testbed for on-board software maintenance
activities.
The EM test bed has already been effectively used to support the diagnostic of
the effect of the solar radio noise on the Huygens receivers that was observed during the first in flight checkouts. It was also extensively used during characterisation
of the receivers anomaly. It will be maintained operational until after the Huygens
mission has been completed.
Notes
1. Deceased, 7 January 2001.
2. Now Alcatel Space.
188
K. C. CLAUSEN ET. AL
Figure 22. The Huygens EM test bed at the Huygens Probe Control Centre (HPOC), in ESOC,
Darmstadt, Germany.
Acknowledgements
The development of the Huygens Probe has been an exciting challenge for the
European Space Agency, its industrial partners and the instrument teams. The
Huygens Project teams express their deep appreciation to the industrial partners
and to the scientific teams for the excellent co-operative spirit during those many
years between lasted the development of the Probe and during the Huygens mission recovery activities. All colleagues who contributed in one way or an other
to these exciting moments are sincerely acknowledged for their tireless efforts.
The excellent co-operation with the JPL Cassini team during the whole life of the
Cassini/Huygens mission is also very much appreciated.
THE HUYGENS PROBE SYSTEM DESIGN
189
References
Carton, C., Dupré R., Sainct H., and Wills R. D.: 1995, The Huygens mission optimisation, Space
Technol. 15 (5), 271-276
Clausen, K. and Sainct, H.: 1994, The Huygens Probe and Mission design, Adv. Space Res. 14 (12),
189–195.
Cluzet, G., Doenecke J., Vollmer K. and Patti, B.: 1998, Huygens Probe: Thermal Design, Test, Flight
Comparison, and Descent Prediction, ICES paper 981644.
Dechezelles, J. J., Prunier C., Couzin, P., McCarthy, C., and Gianolio, A.: 1994, Autonomy
implementation on-board spacecraft: the Huygens Probe architecture. IAAF paper G.5. 356.
Hassan, H. and Jones, J. C.: 1997, The Huygens Probe, ESA Bulletin No. 92, Nov. 1997.
Hassan, H., McCarthy, C. and Wyn-Roberts, D. W.: 1994, Huygens- A Technical and Programmatic
Overview, ESA Bulletin No 77.
Jones, J.C. and Giovanoli, F.: 1997, The Huygens Probe System Design, ESA SP 1177, pp. 25–45.
Jäkel, E., Rideau, P., Nutgeren, P. R., Underwood, J., Faucon, P., and Lebreton, J.-P.: 1998, Drop test
of the Huygens Probe from a stratospheric balloon, Adv. Space Res. 21 (7), 1033–1039.
Lebreton, J.-P. and Matson, D. L.: 2002, The Huygens Probe: Science, Payload and Mission
Overview, Space Sci. Rev. 104, 59–99.
Patti, B.: 1995, The Huygens mission: design approach of an atmosphere entry probe, Control Eng.
Practice 3 (11), 1621–1630.
Sollazzo, C., Dodsworth, S. J. and Wills, R. D.: 1997, The Huygens Probe Mission Flight Operations,
ESA SP 1177, pp. 47–55.